AIMS ISO 42001: The Demonstrable PDCA Cycle
Documenting the AIMS is easy. Proving you audit and review it — the full PDCA — is what gets certified.
Framework / standard: ISO/IEC 42001 §6.2 / §7 / §9.2 / §9.3 / §10.2
Others give you loose pieces of AI governance. Linedat gives you an AIMS that an ISO 42001 auditor recognises, with its PDCA cycle assembled and demonstrable — not a narrative.
The four phases (plan, do, check, act) are modelled as entities chained to the audit log, with a consolidated PDCA view.
Objectives, training, internal audit and management review
AIMS objectives carry KPI, baseline, target and owner (§6.2). Training and policy acceptance are recorded person by person (§7.2/§7.3). The internal audit (§9.2) captures impartiality in three pieces (explicit conflict, four-eyes attestation and reasoned note) and its findings raise a non-conformity. The management review (§9.3) freezes its inputs in a snapshot and requires a statement on the system's continued suitability.
Non-conformities with effectiveness verification
The CAPA register (§10.2) requires verifying effectiveness before closing a non-conformity, with a re-planning loop if the action did not work. It is the "act" pillar of the PDCA — without it, the AIMS does not improve.
The limits (what we do not claim)
Linedat provides the certifiable skeleton and the PDCA evidence, not the certificate: certification is the work of your external auditor. For formal certification, two documentary pieces that depend on your organisation are still missing: the Statement of Applicability (Annex A) and the organisational AI policy (§5.2). Audit/review expiry is read-time, with no scheduled alert.
How Linedat helps
Linedat gives you the certifiable backbone of an ISO 42001 AIMS, with PDCA cycle evidence chained to the audit log — what an auditor looks at first.
Related capabilities
The committee does not decide in a Word document: it decides with evidence linked to the data.
FRIA: Fundamental Rights Impact AssessmentThe FRIA required by EU AI Act Art. 27, versioned and linked to the AI system — not a Word document sitting in a folder.
AI Incidents with the 15-Day ClockA serious incident starts the Art. 73 clock. We start it running and block closure until notification is on record.